mirrors/poky
1
0
Fork 0
mirror of https://git.yoctoproject.org/poky synced 2026-07-26 19:17:07 +00:00
Code Issues Projects Releases Wiki Activity

util-linux: Fix CVE-2024-28085

Browse Source 
wall in util-linux through 2.40, often installed with setgid
tty permissions, allows escape sequences to be sent to other
users' terminals through argv. (Specifically, escape sequences
received from stdin are blocked, but escape sequences received
from argv are not blocked.) There may be plausible scenarios
where this leads to account takeover.

CVE-2024-28085-0005 is the CVE fix and CVE-2024-28085-0001,
CVE-2024-28085-0002, CVE-2024-28085-0003, CVE-2024-28085-0004
are dependent commits to fix the CVE.

References:
https://nvd.nist.gov/vuln/detail/CVE-2024-28085

(From OE-Core rev: 28d9f948536dfee2330e4cfd225c932d20d688f1)

Signed-off-by: Soumya Sambu <soumya.sambu@windriver.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
This commit is contained in:
Soumya Sambu
2024-05-29 06:13:28 +00:00
committed by Steve Sakoman
parent b0b5da10e1
commit ec87d3ca28
6 changed files with 672 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
meta/recipes-core/util-linux/util-linux.inc
+5
View File
@@ -35,6 +35,11 @@ SRC_URI = "${KERNELORG_MIRROR}/linux/utils/util-linux/v${MAJOR_VERSION}/util-lin
file://run-ptest \
file://display_testname_for_subtest.patch \
file://avoid_parallel_tests.patch \
file://CVE-2024-28085-0001.patch \
file://CVE-2024-28085-0002.patch \
file://CVE-2024-28085-0003.patch \
file://CVE-2024-28085-0004.patch \
file://CVE-2024-28085-0005.patch \
"
SRC_URI[sha256sum] = "634e6916ad913366c3536b6468e7844769549b99a7b2bf80314de78ab5655b83"